Failed to connect to a cluster member on SSL Remote Access VPN client

I have ainadequate behaviour in the VPN client site, when the cluster is failover, all the user with MacOS, we see the message "USERNAME tried to connect, but you have reached the number of purchased licenses", and users with windows logean correctly.

In a moment suspect that the device standby, did not have its licenses correctly loaded, but validate them and they are correct.

I would advise you to weed out double / wrong licenses ! On the unit Standby (Problem), i find the same license X.X.X.21 CK XX-XX-XX-XX-XX-XX-XX two times, but once with cpsb-sslvpn-200 cpsb-sslvpn-5 and once with cpsb-sslvpn-5 only. Working FW2- Active has an additional Eval lic that ended 11Jul2017.

Please check the currently licensed blades in UserCenter, download the last generated license again, delete the installed licenses and only install the current ones!

Connection from SNX client / Capsule VPN client / Capsule Connect client / Endpoint Connect client to the VPN Cluster in High Availability mode fails with the error:You cannot receive an office Mode IP address because the security gateway does not have a license for Office mode. Contact your administrator.

Restarting Check Point services ("cpstop;cpstart", reboot) on the Active cluster member resolves the issue until a fail-over occurs from the current Active cluster member to the Standby cluster member.

Debug of VPND daemon (per sk89940) on the Active cluster member shows that the number of "snx_users" is negative:available_om_licenses: number of connected users: om_users XX, snx_users -YY, l2tp_users 0

when a connection to the active member succeeds, kernel debug ('fw ctl debug -m VPN + warn') on the Standby cluster member shows:;sslt_om_ip_params_post_sync: ERROR: Wrong # of vals XX;

All licenses are valid and attached correctly to the Cluster Members.

Cause

Each time a Remote Access VPN client (SNX client / Capsule VPN client / Capsule Connect client / Endpoint Connect client) connects in SSL mode to a Cluster, its connection is synchronized to the Standby cluster member, but the counter of SSL users is not increased on the the Standby cluster member. However, when an SSL user disconnects, the counter of SSL users on the Standby cluster member is decreased.Eventually, this leads to a wrong (negative) license count on the the Standby cluster member.The issue becomes apparent after a failover from the current Active cluster member (that held the correct number of SSL users) to the Standby cluster member (on which the number of SSL users was not updated correctly).

After restarting services, we tested the connection with the vpn client, works correctly, connected to the affected cluster member.

SecureKnowledge solution ID: sk106162 and Title: "Jumbo Hotfix Accumulator for R77.30 (R77_30_jumbo_hf)" has now been edited based on your feedback.

Your feedback was:

------------------

R77.30 jumbo take 338 does not list the issue from sk120652 as resolved, that is listed only for R80.10 Jumbo HotFix - Ongoing Take 142 in sk116380. But according to TAC &amp; simon garay, the jumbo hotfix 338 also mitigates the issue.

------------------

R&D responded: "Following issue from sk120652, raised below, I found that the issue (CR02447010) is listed under take_331 in R77.30 jhf sk106162." sk text was modified to mirror the text in R80.10 jumbo.